Privacy Policy (United States)

1. Who processes your data

The controller of your personal data is Those Who Build Dreams, Inc., a company incorporated in the United States of America, as operator of the Kligrafia service (the “Service”) for the United States market.

Didi Solutions C.A., the Venezuelan company that operates Kligrafia for the Venezuelan market, is not a party to this Privacy Policy and has no role in processing the personal data of customers or signers in the United States.

2. Data we collect

We collect the following categories of data:

• Account data: name, email address, encrypted password, language, and time zone.
• Organization data: company name, tax identifier, member roles, and corporate domain, when you sign up on behalf of a business.
• Identity (KYC) data: government-issued ID (driver's license, passport, or state ID); front and back images of the document; a liveness selfie; derived biometric vectors; and a match score.
• Documents and signatures: uploaded PDFs, signature fields, metadata about the signing process, the signer's IP address, user-agent, timestamps, and the audit trail.
• Billing data: plan history and consumed credits. Card data never touches our servers — it is handled directly by Stripe.
• Usage data: login records, audit events, and technical metrics.
• Communications: notification emails, support messages, and in-platform AI chat messages.

3. How we use your data

We use your data to:

• manage the sending, signing, and tracking of signature envelopes;
• verify your identity and the identity of signers (KYC);
• generate auditable evidence with evidentiary value under the ESIGN Act and UETA;
• process payments and issue receipts;
• meet legal, accounting, tax, and fraud-prevention obligations;
• respond to support requests and improve the product;
• send operational notifications (not marketing, absent your consent);
• defend our legal rights in judicial or administrative proceedings when necessary.

We do not use your personal data or the content of your documents to train artificial intelligence models.

4. Biometric and identity data

The biometric vectors derived from your face during the liveness check, together with government-ID data, are sensitive personal information under applicable state privacy law. Providing biometric data is optional: you may choose an identity verification level that does not require it, unless the document you are signing requires a verification level that does. In addition:

• biometric data is used solely for the identity-verification purpose for which it was collected — never repurposed to identify you in an unrelated context;
• it is not sold, not shared for cross-context behavioral advertising, and not disclosed to social networks or search engines;
• it is stored encrypted, with strict access controls;
• you may request its deletion once the legal retention period applicable to the signed document has elapsed.

5. Subprocessors

We use the following technology providers, acting as subprocessors, to operate the Service:

The current, detailed list — together with the contractual commitments each subprocessor has made to Kligrafia — is available to business customers in our Data Processing Addendum (DPA).

6. Data processing in the United States and abroad

Kligrafia's core infrastructure and most of the subprocessors listed in Section 5 process data within the United States. A limited number of subprocessors process data outside the United States — for example, identity-verification data may be processed by our KYC vendor (based in Colombia/LATAM), and timestamping data by our timestamping authority (based in the EU), as reflected in the table above.

Where a subprocessor operates outside the United States, we require it to contractually commit to confidentiality and security obligations consistent with this Privacy Policy before any data is transferred to it.

7. Data retention

We retain your personal data under our current retention policy, and in any case for as long as the purpose of processing subsists or a legal or contractual duty to retain it exists:

• Account data: for as long as the account is active, plus a grace period after cancellation.
• Signed documents and evidence reports: for the statute-of-limitations period applicable to claims that could arise from the document, under Kligrafia's current retention policy.
• KYC and biometric data: the retention period applicable to the signed document, with a reasonable margin for defending legal rights.
• Billing data: for the period required by applicable accounting and tax rules.

8. Security

• encryption in transit (TLS 1.2+) and at rest (AES-256);
• row-level security in the database, segregated by organization;
• multi-factor authentication available for administrative roles;
• role-based access control on the principle of least privilege;
• audit logs with a hash chain;
• periodic encrypted backups with key rotation;
• dependency review and vulnerability monitoring.

If we detect an incident affecting your personal data, we will notify you without undue delay, with the information reasonably available to us at the time.

9. Your privacy rights under U.S. state law

A growing number of U.S. states have adopted comprehensive consumer privacy laws. Kligrafia is currently below the thresholds (based on revenue and volume of consumers or households) that make most of these laws directly applicable to us. Even so, as a matter of policy we proactively disclose the rights you may have, and we already provide a channel to exercise them regardless of applicability. These are proactive disclosures, not an admission that a particular statute applies to Kligrafia — the phrasing below (“if you are a resident of…”) is intentional.

• If you are a California resident, under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA/CCPA), you may have the right to know and access the personal information we hold about you, request its deletion or correction, obtain a portable copy, opt out of the sale or sharing of personal information and of the use of sensitive personal information beyond what is necessary to provide the Service, and not be discriminated against for exercising these rights.
• If you are a Virginia resident, under the Virginia Consumer Data Protection Act (VCDPA), you may have the right to confirm whether we process your personal data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.
• If you are a Colorado resident, under the Colorado Privacy Act (CPA), you may have rights equivalent to those above, including opting out of targeted advertising, sale, and profiling, and, where technically supported, having that opt-out recognized through a universal opt-out mechanism.
• If you are a Connecticut resident, under the Connecticut Data Privacy Act (CTDPA), you may have rights equivalent to those above, plus the right to appeal our decision on a request.
• If you are a Texas resident, under the Texas Data Privacy and Security Act (TDPSA), you may have rights equivalent to those above, including access, correction, deletion, portability, and opting out of the sale of personal data, targeted advertising, and profiling.

Regardless of your state of residence, Kligrafia does not sell personal data and does not share personal data for cross-context behavioral advertising (as those terms are defined under the CPRA). We do not use advertising or tracking cookies, and we do not knowingly engage in the sale of personal data belonging to anyone, including minors.

10. How to exercise your rights (DSAR process)

To exercise any of the rights described in Section 9, or any other right that may be available to you under applicable law, submit a request to [email protected]. This is our designated Data Subject Access Request (DSAR) channel.

• Identity verification: before fulfilling a request, we will ask you to verify your identity in a manner reasonably matched to the sensitivity of the request (for example, confirming the email address associated with your account), to protect against fraudulent requests. You may designate an authorized agent to submit a request on your behalf, subject to the same verification.
• Response time: we aim to confirm receipt of your request promptly and to respond within forty-five (45) days of receiving a verifiable request, consistent with the CPRA. Where reasonably necessary, we may extend this period by an additional forty-five (45) days, in which case we will notify you of the extension and the reason for it within the initial 45-day period.
• No fee for your first request: we do not charge a fee for the first request you submit in a rolling 12-month period. A reasonable fee may apply to requests that are manifestly unfounded, excessive, or repetitive, as permitted under applicable state law.
• Manual fulfillment (for now): Kligrafia is an early-stage company and does not yet operate a self-service DSAR portal — requests are currently reviewed and fulfilled manually by our team. We are building toward more automated tooling as we grow.
• Non-discrimination: we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised a privacy right.

11. Cookies and similar technologies

We use cookies that are strictly necessary to keep you authenticated and to protect the platform against CSRF attacks. We do not use advertising-tracking cookies and do not share identifiers with social networks by default.

12. Children’s privacy

The Service is intended exclusively for individuals 18 years of age or older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we become aware that an account belongs to a minor without the consent required by applicable law, we will suspend and delete it. If you are a parent or guardian and believe a minor has provided us with personal information, contact [email protected].

13. Changes to this policy

We may update this policy to reflect regulatory or product changes. We will notify you of material changes by email or through a visible notice on the platform at least fifteen (15) days in advance.

14. Contact

For any question about this Privacy Policy, or to submit a privacy rights request, write to us at: